No taint warning with lambda

[JarLob]

Analyzer

CA3001, but probably all taint tracking analyzers

Analyzer source

Master branch

Describe the bug

No security warning (taint tracking issue?) when the sink is in lambda

Steps To Reproduce

Modify the existing DocSample1_CSharp_Violation_Diagnostic to:

using System;
using System.Data;
using System.Data.SqlClient;

namespace TestNamespace
{
    public partial class WebForm : System.Web.UI.Page
    {
        public static string ConnectionString { get; set; }

        protected void Page_Load(object sender, EventArgs e)
        {
            string name = Request.Form[""product_name""];
            using (SqlConnection connection = new SqlConnection(ConnectionString))
            {
                Func<string, SqlCommand> lambdaExpr = (x) => {
                    SqlCommand sqlCommand = new SqlCommand()
                    {
                        CommandText = ""SELECT ProductId FROM Products WHERE ProductName = '"" + x + ""'"",
                        CommandType = CommandType.Text,
                    };
                    return sqlCommand;
                };
                SqlCommand cmd = lambdaExpr(name);

                SqlDataReader reader = cmd.ExecuteReader();
            }
        }
    }
}

Expected behavior

Warning

Actual behavior

No warning. Test fails.

[Evangelink]

@dotpaul are we able to track such case with the current dataflow? In my past job we had to implement a more complex flow parsing to handle such cases.

[dotpaul]

@Evangelink DataFlowOperationVisitor has a VisitInvocation_Lambda method, but TaintedDataOperationVisitor doesn't implement it. I don't remember why not. I'll take a look later if no one else figures it out.